HAProxy and Varnish: supported branches and updates

Updated November 2026

HAProxy and Varnish sit at the front of many web stacks and handle every request first. Run a branch that still gets fixes: for HAProxy, an LTS branch such as 3.0, 3.2 or 3.4; for Varnish, 9.1 or 6.0. Test the configuration before every reload or restart.

What they are

HAProxy is a load balancer and reverse proxy for HTTP and TCP. It often terminates TLS and spreads traffic over several backend servers. Varnish is a caching HTTP reverse proxy. It keeps copies of pages in memory and serves them without asking the backend each time. Its behaviour is set in VCL, a small configuration language. Both parse untrusted HTTP/1, HTTP/2 and (for HAProxy) QUIC traffic directly from the internet. That is where most of their recent security bugs were found.

Check the installed version

haproxy -v            # version and release date
haproxy -vv           # plus build options and the OpenSSL version it uses
varnishd -V           # Varnish / Vinyl Cache version

Then check the package and where it comes from. Distributions backport fixes, so the version number alone does not tell you whether you are patched:

apt policy haproxy varnish        # Debian / Ubuntu
rpm -q haproxy varnish            # RHEL family, SUSE

HAProxy supported branches

HAProxy releases a new branch twice a year. Even-numbered branches released in late spring (3.0, 3.2, 3.4) are long-term support (LTS) branches with five years of maintenance. Other branches are maintained for about 12 to 15 months. As of November 2026, the branch table on haproxy.org shows:

The table marks 3.1, 2.9, 2.7, 2.5, 2.4 and all older branches as unmaintained. Version 3.5 is in development and is expected to become stable around the end of 2026. Branches on "critical fixes only" still get the most serious fixes, but plan to move off them.

The latest security announcement on haproxy.org (February 12, 2026) covers two QUIC parsing bugs, CVE-2026-26080 and CVE-2026-26081. Specially crafted packets could crash the process (a denial of service). Fixed releases were 3.0.12, 3.1.14, 3.2.12 and 3.3.3. The current releases of the affected branches include these fixes.

Varnish and Vinyl Cache

The open-source Varnish Cache project renamed itself Vinyl Cache; the rename was finished with the 9.0 release on March 16, 2026. Varnish Software now publishes its own "Varnish Cache" at varnish.org, which it describes as a downstream distribution of Vinyl Cache. The old varnish-cache.org address now redirects to varnish.org. Vinyl Cache releases every six months. Both projects publish the same security advisories (VSV numbers).

Both sites say every release not listed is end-of-life. That includes 8.0 and all 7.x versions. The newest advisory, VSV00020 (September 16, 2026), is a workspace overflow in the VCL .upper() and .lower() string methods. It affects Varnish 6.3.0 to 8.0.2, Varnish 9.0 up to 9.0.3 and Vinyl Cache up to 9.0.1. It is fixed in Varnish 9.0.4 and Vinyl Cache 9.1.0 and 9.0.2. The 6.0 LTS series is not affected. Until you can update, replace those methods with std.toupper() and std.tolower() from vmod_std. The previous advisory, VSV00019 (CVE-2026-50052), is an HTTP/2 parsing bug.

Distro packages or project repository

Distribution packages

Debian, Ubuntu, RHEL, SUSE, Alpine and FreeBSD ship both programs and backport security fixes into the version they chose. This is the easiest path, but you get an older branch.

HAProxy for Debian and Ubuntu

The Debian HAProxy packaging team runs haproxy.debian.net. You pick your release and the HAProxy branch you want, and it shows the repository or Ubuntu PPA (ppa:vbernat/haproxy-…) to add. You then get updates within that branch.

Varnish repository

The varnish.org install guides add packages.varnish-software.com for Debian, Ubuntu, RHEL-compatible systems and Amazon Linux. There is also an official varnish Docker image; you can pin a version tag, and you pull the image again to get fixes. Do not mix distro and project packages by accident: check the repository line in apt policy or dnf info.

Update commands

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade haproxy varnish

# RHEL, Rocky, AlmaLinux
sudo dnf upgrade --refresh haproxy varnish

# SUSE / openSUSE
sudo zypper refresh
sudo zypper update haproxy varnish

# Alpine
sudo apk update
sudo apk upgrade haproxy varnish

# FreeBSD (Varnish package names include the major version)
sudo pkg update
sudo pkg upgrade haproxy
pkg info | grep -i varnish      # then: sudo pkg upgrade <that name>

# Docker
docker pull haproxy:3.2         # use your branch tag
docker pull varnish            # or pin a version tag

Leave out the program you do not run. After pulling a new image, recreate the container. See containers.

Test the config, then reload or restart

sudo haproxy -c -f /etc/haproxy/haproxy.cfg
sudo varnishd -C -f /etc/varnish/default.vcl > /dev/null && echo "VCL compiles"

HAProxy: the systemd unit runs HAProxy in master-worker mode. On systemctl reload haproxy the master re-executes itself and starts new workers, while old workers finish their connections. After an update, run the check, then reload. Confirm with haproxy -v and systemctl status haproxy that the new version runs. If in doubt, restart (this drops open connections):

sudo haproxy -c -f /etc/haproxy/haproxy.cfg && sudo systemctl reload haproxy
sudo systemctl restart haproxy      # restarts the service

Varnish: systemctl reload varnish runs varnishreload, which only loads new VCL. A new varnishd binary needs a restart. A restart empties the cache, so your backends get more traffic for a while:

sudo systemctl restart varnish      # restarts the service and clears the cache

Verify

• haproxy -v and varnishd -V show the fixed version, and the package manager shows the patched package.
• The service start time is after the update (systemctl status).
• The site answers through the proxy: curl -sI https://www.example.com/.
• Logs are clean: journalctl -u haproxy -n 50, journalctl -u varnish -n 50.

Where advisories are published

• HAProxy: security announcements and the branch table on haproxy.org. Releases are announced on the haproxy@formilux.org mailing list (archive on mail-archive.com).
• Varnish: varnish.org/docs/security/. Report new bugs to security@varnish-software.com.
• Vinyl Cache: vinyl-cache.org security. New vulnerabilities are announced on announce@vinyl-cache.org and the home page.
• For packaged versions, follow your distribution's list. See security advisories and vulnerabilities.

Quick hardening tips

• Expose only the ports you need. Keep the HAProxy stats page and runtime socket, and the Varnish admin port (CLI), off the internet. See firewall.
• Keep backends reachable only from the proxy, so nobody can bypass it.
• Turn off protocols you do not use, such as HTTP/2 or QUIC/HTTP/3, until you need them. Several recent bugs in both programs were in the HTTP/2 or QUIC code.
• Set timeouts and connection limits to blunt slow-client and flood attacks. See DDoS.
• Restart HAProxy after OpenSSL updates, because it keeps the old library in memory. See OpenSSL.
• Do not cache responses that set cookies or carry private data unless you mean to.

Sources

• HAProxy home page (branch table and security announcements), haproxy.org
• HAProxy Management Guide 3.2, haproxy.org
• Debian/Ubuntu HAProxy packages, Debian HAProxy packaging team
• Varnish Cache releases, varnish.org
• Varnish security, bugs and vulnerabilities, varnish.org
• Varnish Debian and Ubuntu install guide, varnish.org
• Varnish Docker install guide, varnish.org
• Vinyl Cache releases, vinyl-cache.org
• VSV00020: VCL string methods workspace overflow, vinyl-cache.org
• On Vinyl Cache and Varnish Cache, vinyl-cache.org